fledgify proof v0

An outside-in check, run from a stranger's vantage on nothing but a public URL,
that a stranger can actually pay for an offer. It never buys, never enters a
card, never submits a form, and never writes to anyone's system.

A proof attests to what was observed, at a time, from a vantage. It never
attests to the seller's honesty.

  GET  /v0/proof?url=https://example.com/offer      the report as JSON
  GET  /v0/proof.txt?url=https://example.com/offer  the same report as text
  GET  /p/<record id>.json                          a stored proof, exactly as observed
  POST /mcp                                         MCP, one tool named proof
  GET  /openapi.json  /v0/schema.json  /llms.txt    the contracts

Verdicts are PROVEN, NOT_PROVEN and NOT_CHECKED. NOT_CHECKED always names what
blocked the check and is never a pass. Every HTTP answer that carries a proof
(/v0/proof, /v0/proof.txt, /p/<id>, and the redirect from /prove) has the
verdict in the x-fledgify-verdict header and its permanent record in
x-fledgify-record. Over MCP the same facts are in the structured content.

The url parameter must parse, must be http or https, and must not name a
private or loopback host. Anything else answers 400 with the reason.

Every proof makes about a dozen outbound requests, so this endpoint is
limited to protect the sites it is pointed at: 10 proofs a minute per
caller, 6 a minute per site, and 30 a minute for the whole
service, each counted exactly across every Cloudflare location. Over a caller
or site limit answers 429, over the service limit answers 503, both with a
retry-after header. A recent report for the same URL is served from cache (header
x-fledgify-cache: HIT); the report's own startedAt and finishedAt say when it
was actually observed.